France has accused Iran of launching a series of destructive cyberattacks against its critical infrastructure in October. The French National Cybersecurity Agency, ANSSI, reported that Iranian military hackers targeted refrigeration controllers at around 700 different retail sites in France, from supermarkets to butcher shops. The hackers turned up the temperature in the middle of the night, spoiling millions of dollars' worth of food.
The attacks also targeted several small hydroelectric power plants, resulting in moderate effects, according to ANSSI. French Foreign Minister Jean-Noël Barrot described the hacking campaign as unprecedented in both its scale and level of aggression. He stated that it marks the first large-scale cyberattack aimed at sabotage on French national territory, constituting a major attack on the nation's interests and the security of the French people.
The Paris Prosecutor's Office has opened an investigation into the Iranian cyber unit, Shahid Kaveh, which the French government links to Iran's Islamic Revolutionary Guard Corps. The office is requesting the issuance of international arrest warrants. A trend of attacks on refrigeration systems has been observed, with similar incidents reported in Europe, Israel, and the United States.
In 2026 alone, hackers have targeted refrigeration controllers from Europe to Israel and the United States. Grocery stores in European countries, including Sweden and Ireland, were hit in similar attacks last week. In a separate incident in France, employees at a major French blood bank had to act fast to save blood samples from heating up when their refrigeration system was hit last week.
The French government identified the hackers through digital clues, including digital infrastructure used by the hackers, connection to a propaganda outlet, and traces of the use of Farsi language in the attack. While US officials suspect Iran may have been behind attacks on US military bases in August, the Pentagon has not made an official statement.
Cybersecurity experts say the attacks fit Iranian hackers' modus operandi. Alex Orleans, head of threat intelligence at Sublime Security, stated that Iran's cyberattacks against refrigeration systems likely represent the IRGC attempting to reassert Iranian power abroad through physically and psychologically disruptive operations.
The attacks highlight a yearslong difficulty with securing operational technology, the machines that control physical processes in the real world. These machines are often outdated, riddled with vulnerabilities, and difficult to patch without disrupting critical services. Iran has yet to respond to the accusations, but the French government's accusation may lead other affected countries to take action.
Key points
- The French government has formally assigned blame for the wave of destructive attacks to Iran's Islamic Revolutionary Guard Corps.
- The attacks on refrigeration controllers have highlighted a yearslong difficulty with securing operational technology.
- The French government is seeking international arrest warrants for those involved in the cyberattacks.
